Hacker News Reader

Comment by ancarda | Hacker News Reader

Can those customers not install ClamAV? Does that not count as anti-virus?

If you were to test ClamAV on a few thousand malware samples you would probably find that the detection rate would be in the low single digits.

At the same time, ClamAV has a terrifying CVE track record.

There's no upside, and all downside.

CVE track record for ClamAV is not perfect, but doesn't seem out of line with similar products.

ClamAV: https://www.cvedetails.com/product/15657/Clamav-Clamav.html?...

Norton AV: https://www.cvedetails.com/product/398/Symantec-Norton-Antiv...

Windows Defender: https://www.cvedetails.com/product/9767/Microsoft-Windows-De...

It may be safer to say that the CVE record for most AV software isn't great.

As I understand it, Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly.

Given that, a possible upside with ClamAV could be that you could verify the behaviour of the processes on the installed systems, to make sure you're up-to-date and have the correct software and signatures installed.

That's not unreasonable - Microsoft's software delivery pipeline should be trustworthy and their security reputation could be damaged if an issue were discovered here.

> Microsoft Defender may not be open source, so you have to trust that what you're running really is Microsoft Defender and that it's behaving correctly.

That’s true of everything installed on a system - if you don’t control the software you’re running, Defender is the least of your worries. Unless you’re doing a full analysis of every binary you’re trusting the source.

Fun fact that doesn't actually pass on pci-dss1 audit. You need a commercial antivirus with active subscription and centralized monitoring of that.

Also I'm guessing it's easier for admins of mixed infra to have a single threat definition (ie. So your storage server catches the same threats as your endpoints)

Actually, most assessors won't require A/V on Linux.

5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).

It's typically an ignorant CISO/CSO who wants to mark a checkbox...

It's not necessarily ignorance, but also risk management. Who is the CIO to say that Linux is exempted from that condition? He'd need a stack of evidence that it's not commonly affected, which would need to be kept up to date .

Easier just to say "AV on everything".

A CSO/CISO should be aware of what the threats to their environment are. Otherwise how can they effectively mitigate the risk? They should rely upon SMEs who can keep them abreast of changes in threat models.

Pretending Linux can't host or be affected by malware is a pretty ignorant thing for any ciso/cto to do.

God I wish - central management and logging is mandatory under all of these compliance regimes.

We’re in the middle of adopting HiTrust and I’ve been forced to install Cisco AMP on all of my servers. The product is absolute garbage and frequently eats up all available RAM, causing itself to crash and leave a core dump filling up my root partition.

The worst part? AMP on Linux is literally ClamAV plus a kernel module to monitor file access, network connections and process creation.

We've deployed AMP across our RHEL environment, and experienced the exact issues you've described. Cisco's general remediation is to increase the exclusion policy til the core dumps stop occurring. On some systems, AMP is barely monitoring any filesystems...

Can I buy an enterprise support contract for it? I honestly don’t see an option on the site. That’s usually a hard requirement in the enterprise.

Cisco AMP is just re-badged ClamAV.

Reply on news.ycombinator.com